ci: add timeout-minutes to workflow jobs

[mr-raj12]

Closes #62103

Problem

Most jobs across the repo's GitHub Actions workflows have no timeout-minutes set. A job without one inherits the platform default of 6 hours, so a step that hangs (a stuck network call, a deadlocked test, a wedged subprocess) keeps a runner busy for hours before the run is cancelled. Some workflows already set it (lint.yml, docker.yml, docker-lint.yml, the test/e2e jobs in tests.yml, uv-lockfile-check.yml), so the gap was inconsistent coverage rather than a deliberate policy.

Solution

Add a timeout-minutes cap to every job that was missing one, sized to the work each job does:

Workflow	Job(s)	timeout-minutes
ci.yml	detect, all-checks-pass	5
ci.yml	ci-timings	10
contributor-check.yml	check-attribution	10
docs-site-checks.yml	docs-site-checks	10
history-check.yml	check-common-ancestor	10
skills-index-freshness.yml	check-freshness	10
deploy-site.yml	deploy-vercel, deploy-docs	15
skills-index.yml	build-index, trigger-deploy	15
supply-chain-audit.yml	scan, dep-bounds, mcp-catalog-review	15
tests.yml	generate, save-durations	15
upload_to_pypi.yml	build, publish, sign	20

typecheck.yml is intentionally left out. Its read-only permissions change is already in flight in #45731, and the remaining concurrency plus timeout-minutes work for that file is tracked on its own, so editing it here would only create a conflict.

Testing

• Parsed every .github/workflows/*.yml with yaml.safe_load before and after the change. All files parse, and the only job still without a timeout-minutes is in typecheck.yml, which is the intended exclusion.
• Confirmed the diff is additive only: 19 lines across 10 files, one per job, with nothing else touched.

[teknium1]

Thanks for the focused CI hardening change. Current main still has the reported uncapped jobs, including .github/workflows/ci.yml:37, :153, and :179, while comparable jobs already use the same native timeout-minutes key (for example .github/workflows/tests.yml:45 and :158). The PR adds only the missing job-level limits across the ten stated workflow files.

Automated hermes-sweeper review.

[mr-raj12]

Thanks a lot boss for the review! Rebased onto latest main and re-verified — only typecheck.yml jobs are left uncapped as intended (tracked separately), rest all sorted.